Audit 08 – Training, Competence and Human Resources Company: Viamed Ltd Standard: ISO 13485:2016 Employee sampled: Catherine Spence Employee ID: 6 Primary role: Goods Out Audit date: 31 July 2026 Auditor: Derek Lamb 1. Audit scope and objective Catherine Spence was selected as the employee sample for Audit 08. The purpose of the review was to confirm that: her responsibilities are defined and understood; appropriate training and competence records are maintained; there is evidence that training has been effective; required policies and procedures have been communicated; working hours, holidays and breaks are recorded; relevant health and safety areas have been identified; her assigned processes have suitable backup and ongoing review; practical work completed by Catherine is accurate and traceable. The review considered Catherine’s employee record, training history, required reading, assigned processes, working hours, holiday records, HSE areas, picking and order-processing statistics, and a sampled customer order. 2. Documents and evidence reviewed The audit reviewed the following evidence: Catherine Spence’s employee training record; employee process and responsibility review; required-reading record; working-times and breaks record; holiday entitlement and booking record; employee HSE work-area record; timesheet records; order-entry and invoice statistics; July 2026 picking statistics; Customer Order 164909; customer repair request SRS69468; purchase-order reference GMPS16818723; repair record SRN38916; invoice RVM164909-1; delivery note DVM164909-1. 3. Responsibilities and authorities Catherine’s principal allocated role is recorded as Goods Out. Her employee review identifies 30 allocated processes, comprising: 28 active processes; two responsibility-only processes. The responsibility-only processes are Franking Mail and Main Recycle Bins. These do not require separate rolling tasks or audits. The records demonstrate that Catherine performs a broader range of operational duties connected with Goods Out, including: picking and scanning stock; creating and modifying customer orders; producing repair quotations; committing invoices; processing dispatch paperwork; checking back orders; undertaking routine warehouse and system tasks. The duties reviewed are consistent with the activities shown in her employee and transaction records. Finding: Responsibilities are defined within the employee role and process-management system. Practical activity records demonstrate that the responsibilities have been communicated and are being performed. 4. Training and competence records Catherine has an extensive employee training record covering operational systems, products, warehouse activities and general workplace requirements. Examples include: Intrastats Issues training; sensor-boxing refresher training; oxygen-monitoring and oxygen-sensor products; pulse oximeters; capnography and other monitoring products; purchasing and sales-order processing; contact management; customs duties; production and QA activities; telephone, card-payment and holiday systems. The training record includes the training method, trainer, completion date and validity period where applicable. Catherine’s First Aid training is recorded as valid until 20 October 2026. The training page records that Catherine last formally reviewed her training record on 24 February 2025. Training entries have subsequently been added, including Intrastats Issues training completed on 3 September 2025. This indicates that the record continues to be maintained, although Catherine’s own formal acknowledgement or periodic review is now more than 12 months old. Finding: Appropriate training records are maintained and are relevant to Catherine’s operational activities. Opportunity for improvement: Catherine should complete a current formal review of her training record to confirm that the listed training remains accurate and that no additional training needs have arisen. 5. Evaluation of competence and training effectiveness Competence was evaluated through operational statistics and a practical transaction sample rather than relying solely on the existence of training records. Picking activity For July 2026, Catherine recorded: 3,083 individual items scanned; 143 orders picked; 22 days working in picking; an average of 140.14 items scanned per picking day; an average of 6.50 orders picked per day. This provides evidence that picking is a regular and established part of her role rather than an occasional activity. Order and invoice activity For the period 1 July 2025 to 31 July 2026, Catherine was recorded as having: created 168 customer orders; modified 169 orders; created 1,839 invoices. The volume and continuity of this activity support her experience in customer-order and invoicing processes. 6. Practical transaction sample – Order 164909 A recent customer transaction completed by Catherine was selected to assess practical competence and document traceability. Customer request and repair The customer returned a VM-2500-S Capnograph, serial number 60940148, under repair reference SRS69468. The reported fault was that the real-time clock would not retain the correct time. The customer requested a quotation before chargeable work was undertaken. The Viamed repair record confirms: receipt on 13 July 2026; booking-in by Robert Connor; service reference SRN38916; the real-time clock was reset; the clock was confirmed as operating correctly; 0.5 hours of labour was recorded. Catherine’s processing activities The order system records that Catherine: prepared the repair quotation information; created Order 164909 on 24 July 2026; was recorded as the paperwork originator; modified the order on 31 July 2026; picked the order; committed Invoice RVM164909-1. Aqib Majeed independently checked the order before it was picked and invoiced. Kate Griffiths sent the quotation, and Helen Lamb subsequently sent the invoice data to Xero. This provides evidence of both competence and segregation of duties. Pricing check The repair quotation recorded: stock reference 4440000; 0.5 hours; unit rate £98.70; total labour value £49.35. The final invoice recorded: labour: £49.35 net; UPS delivery: £12.00 net; total net: £61.35; VAT: £12.27; invoice total: £73.62. The calculation was correct. Traceability check The following information was consistent across the relevant records: customer; contact name; account number; serial number 60940148; repair reference SRS69468; service record SRN38916; customer purchase-order reference GMPS16818723; invoice reference RVM164909-1; delivery reference DVM164909-1; labour value; delivery address. The delivery note also carried the correct equipment, serial number, repair reference and customer purchase-order reference. The repair reference SRS69468 and customer purchase-order reference GMPS16818723 serve different purposes and are both retained, maintaining traceability through the transaction. Finding: The sampled order was accurate, independently checked and fully traceable. It provides satisfactory objective evidence that Catherine is competent in the relevant order-processing, picking and invoice-creation activities. 7. Required reading and employee awareness The required-reading system demonstrates that Catherine has previously acknowledged a substantial number of personnel, health and safety and quality documents. The record also lists documents not yet read. These include several personnel policies revised in late July 2026, such as: absence due to sickness; maternity rights; parental and neonatal care leave; paternity leave; parental bereavement leave; adoption leave; shared parental leave. As these documents had only recently been revised at the time of the audit, it is reasonable for them to remain pending temporarily. However, several older documents are also recorded as not read, including: CPM 10 Capability Procedures; CPM 32 Joining Our Company; CPM 33 Safeguards; CPM 34 Standards of Operation; CPM 35 Salaries, Wages and Attendance. VOP 05 was also listed as not read, although this had only recently been revised. The required-reading allocation should be reviewed to distinguish: genuinely overdue acknowledgements; recently issued documents awaiting normal completion; documents that may not be relevant to Catherine’s role; historic documents that may have been allocated retrospectively. Opportunity for improvement: Review Catherine’s unread-document list and either obtain acknowledgement within a reasonable period or remove documents that are not applicable to her role. No evidence was identified that the unread items had adversely affected the sampled work. 8. Process allocation and backup coverage Catherine’s employee process report records: 28 active assigned processes; five overdue rolling tasks or audits; one process for which Catherine is the only trained employee; one process with only one trained employee and therefore no backup; nine processes without a separate audit configured; all processes reviewed within the preceding 24 months; all processes having measurable objectives; two of the 28 active processes scoring below four of six maturity checks. The report’s automated warning regarding five overdue rolling items should be reviewed at process level. Some system tasks may appear outstanding simply because they were recently generated and remain within an acceptable working period. The single-trained process represents a potential continuity weakness and should be identified and assessed. Where the activity is material to product quality, customer service or regulatory compliance, an appropriate backup should be trained. The absence of a separate rolling audit on nine processes does not automatically indicate a nonconformity. Some processes may be checked through another audit, management review, routine verification or wider departmental control. The audit linkage should nevertheless be confirmed. Opportunity for improvement: Identify the single-trained process and either provide backup training or document why sole coverage is acceptable based on the process risk. Opportunity for improvement: Review the five apparently overdue items and the nine processes without configured audits to confirm that appropriate verification arrangements exist. 9. Working hours, breaks and holidays Catherine’s recorded working pattern is: Monday to Friday; 07:00 to 16:30; 30-minute lunch break each day; 47.5 hours attendance per week; 45 actual working hours after lunch deductions. Her 2026 holiday entitlement is recorded as 252 hours, based on the stated five-day, 45-hour working week. Holiday, bank-holiday, overtime and time-off-in-lieu entries are separately recorded and authorised within the system. Timesheet records provide detailed evidence of attendance, holiday, overtime and time-off-in-lieu activity. The audit noted that Catherine frequently works beyond the standard 16:30 finish and occasionally records weekend work. These entries are generally identified as overtime, working time to be paid or time in lieu. The records therefore appear capable of distinguishing normal hours from additional time. No evidence of an unauthorised absence or unexplained attendance pattern was identified from the reviewed records. Finding: Contracted hours, breaks, holidays and additional working time are documented and traceable. 10. Health and safety and work environment An employee HSE-area record exists for Catherine and includes warehouse, stock, Goods Inwards, Goods Out, nonconforming stock, stairs, offices and other potential work areas. The report supplied for audit lists the available work areas but does not clearly show from the extracted output which specific areas are selected for Catherine. Given Catherine’s Goods Out and picking duties, her relevant areas would reasonably be expected to include: Goods Out; warehouse stock rooms; Goods Inwards where applicable; warehouse corridors and stairs; parcel and dispatch areas; nonconforming stock areas where she may enter; any authorised working-from-home area. Opportunity for improvement: Confirm that Catherine’s selected HSE work areas accurately reflect the areas she regularly works in or visits. The training and required-reading records include health and safety and first-aid information. No evidence was identified that Catherine undertakes work requiring a controlled cleanroom or other special environmental competence. 11. Assessment against ISO 13485:2016 Clause 5.5.1 – Responsibility and authority Catherine’s role and assigned processes are documented. Her system activity demonstrates that she understands and carries out the allocated operational responsibilities. Assessment: Conforming. Clause 6.2 – Human resources Relevant training records are maintained. Competence is supported by experience, activity statistics, process records and the satisfactory sampled transaction. Training effectiveness was demonstrated through practical work rather than merely completion of a training entry. There are administrative improvements available concerning the date of Catherine’s formal training review, unread documents and backup coverage. Assessment: Conforming, with opportunities for improvement. Clause 6.4.1 – Work environment Relevant work areas and HSE information are controlled within the employee system. The specific HSE-area selections should be confirmed. No evidence was identified that unsuitable environmental conditions or lack of competence had affected product or service quality. Assessment: Conforming, with an opportunity for improvement. Clause 7.3.2 – Design and development competence No evidence was identified that Catherine holds responsibility for product design or development. This clause was therefore not directly applicable to the selected employee sample. Assessment: Not applicable to Catherine’s sampled activities. Clause 8.2.4 – Internal audit Catherine was selected as an employee sample and evidence was traced through training records, process allocation, work activity and a completed customer transaction. The review identified positive evidence and proportionate improvement actions. Assessment: Audit evidence sufficient for the employee sample. 12. Positive findings Catherine has extensive and relevant training records covering her operational activities. High levels of picking and invoicing activity provide evidence of current practical experience. The sampled repair order was accurate and traceable from the original customer request through repair, quotation, order creation, independent checking, picking, invoicing and dispatch. The pricing and VAT calculations within the sampled order were correct. Key identifiers were consistently maintained, including customer PO, repair reference, serial number, invoice reference and delivery reference. Independent checking and segregation of duties were evident within the sampled transaction. Working hours, holiday entitlement, additional working time and breaks are documented. All assigned processes have measurable objectives and had been reviewed within the previous 24 months. 13. Opportunities for improvement OFI 1 – Formal training review Catherine’s training record was last formally reviewed by her on 24 February 2025. Recommended action: Ask Catherine to review and acknowledge her current training record and identify any further training needs. OFI 2 – Required reading A number of required-reading items remain outstanding. Some are newly revised, while others are older. Recommended action: Review the allocation and set an appropriate completion period for applicable documents. OFI 3 – Process backup One allocated process appears to rely solely on Catherine. Recommended action: Identify the process and train a backup or document a proportionate risk-based justification for sole coverage. OFI 4 – Rolling tasks and audit coverage The employee report identifies five overdue rolling items and nine processes without a configured audit. Recommended action: Review each item to determine whether it is genuinely overdue and whether verification is provided through another process or audit. OFI 5 – HSE-area confirmation The HSE-area report does not clearly demonstrate which locations are selected. Recommended action: Confirm and update Catherine’s HSE areas to match her actual work and access. 14. Nonconformities No nonconformities were identified from the Catherine Spence employee sample. The items identified relate to administrative maintenance, backup resilience and confirmation of existing controls. No evidence was found of incompetence, incorrect work, loss of traceability or an adverse effect on product or service quality. 15. Overall audit conclusion The training, competence and human-resource controls reviewed for Catherine Spence are generally effective and suitably implemented. Catherine has relevant training, significant practical experience and demonstrable competence in Goods Out, picking, order processing and invoice creation. The sampled customer transaction was complete, accurate, independently checked and traceable throughout. The review identified several opportunities to improve record maintenance and resilience, principally: updating the formal employee training review; resolving or rationalising required reading; addressing the single-trained process; reviewing apparently overdue rolling items; confirming HSE-area allocation. These matters do not presently indicate a failure of the training or competence system and do not justify a nonconformity. Overall audit result: ☒ The process is generally effective, with opportunities for improvement. ☐ Minor weaknesses were identified and corrective action is required. ☐ Significant weaknesses were identified and urgent corrective action is required.